From 2123263ad5b7b33ac5bd4d139e95f0a44995d919 Mon Sep 17 00:00:00 2001 From: unknown Date: Sat, 13 Dec 2003 16:40:52 +0100 Subject: WL#1365: Implement definer's rights execution of stored procedures. (Also put the hostpart back in the definer column.) mysql-test/r/sp-error.result: Moved error test from sp.test mysql-test/r/sp.result: Moved error test to sp-error.test. Put hostpart back into definer column in mysql.proc. mysql-test/t/sp-error.test: Moved error test from sp.test mysql-test/t/sp.test: Moved error test to sp-error.test. Put hostpart back into definer column in mysql.proc. sql/item_func.cc: (Maybe) switch security context before invoking a stored function. sql/sp.cc: Renamed creator into definer, for more consistent terminology, and put the hostpart back. sql/sp_head.cc: Some fixes in the way things are allocated, and moved set_info() definition here from sp_head.h. creator is now called definer, and is split into a user and host part. Added functions for (possible) change and restore of privileges, for sql security definer calls. sql/sp_head.h: Moved set_info() definition here from sp_head.h. creator is now called definer, and is split into a user and host part. Added functions for (possible) change and restore of privileges, for sql security definer calls. sql/sql_acl.cc: New function acl_getroot_no_password() for getting the privileges used when calling an SP with sql security definer. sql/sql_acl.h: New function acl_getroot_no_password() for getting the privileges used when calling an SP with sql security definer. sql/sql_parse.cc: (Maybe) switch security context before invoking a stored procedure. sql/sql_yacc.yy: Fixed typo. --- mysql-test/r/sp-security.result | 44 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 mysql-test/r/sp-security.result (limited to 'mysql-test/r/sp-security.result') diff --git a/mysql-test/r/sp-security.result b/mysql-test/r/sp-security.result new file mode 100644 index 00000000000..00e22ceebd4 --- /dev/null +++ b/mysql-test/r/sp-security.result @@ -0,0 +1,44 @@ +use test; +grant usage on *.* to dummy@localhost; +drop database if exists db1_secret; +create database db1_secret; +use db1_secret; +create table t1 ( u varchar(64), i int ); +create procedure stamp(i int) +insert into db1_secret.t1 values (user(), i); +show procedure status like 'stamp'; +Name Type Definer Modified Created Security_type Comment +stamp PROCEDURE root@localhost 0000-00-00 00:00:00 0000-00-00 00:00:00 DEFINER +call stamp(1); +select * from t1; +u i +root@localhost 1 +call stamp(2); +select * from db1_secret.t1; +ERROR 42000: Access denied for user: 'dummy'@'localhost' to database 'db1_secret' +call stamp(3); +select * from db1_secret.t1; +ERROR 42000: Access denied for user: ''@'localhost' to database 'db1_secret' +select * from t1; +u i +root@localhost 1 +dummy@localhost 2 +anon@localhost 3 +alter procedure stamp sql security invoker; +show procedure status like 'stamp'; +Name Type Definer Modified Created Security_type Comment +stamp PROCEDURE root@localhost 0000-00-00 00:00:00 0000-00-00 00:00:00 INVOKER +call stamp(4); +select * from t1; +u i +root@localhost 1 +dummy@localhost 2 +anon@localhost 3 +root@localhost 4 +call stamp(5); +ERROR 42000: Access denied for user: 'dummy'@'localhost' to database 'db1_secret' +call stamp(6); +ERROR 42000: Access denied for user: ''@'localhost' to database 'db1_secret' +use test; +drop database db1_secret; +delete from mysql.user where user='dummy'; -- cgit v1.2.1